Captcha Woes
Even the most complex captchas can be bypassed, if not tested thoroughly enough.
Some time ago, I implemented a captcha on my comments form for news posts, to stop spam bots. My captcha is quite complicated, and sometimes generates images that even humans strugle on, yet for some reason I managed to get 10788 spam comments!
I immediately tested my captcha - tried with no value, a wrong value, a right value, only the right one worked.
Then I tried in a different window, open 2 tabs to the same comment, submit the 2nd one with no data and get told the correct captcha, then try using that on the first window, this also didn’t work - however, it told me the correct captcha was “”, upon hitting back and trying with no captcha, it worked.
Turns out I had forgot to make "" an invalid captcha when testing if the values were correct, seeing as when you submit the captcha, it clears the captcha session, a blank value WAS indeed the same value that was stored in the session! The spam bots were just not accepting the session, and thus had a blank captcha - and by them not filling in the captcha, and not accepting the session, they were able to submit comments. This has now been fixed, and a blank captcha will now give an error of “Captcha Timeout”.
Fortunately, 3 Simple SQL Queries pruned the lot :) 1 of which pruned 7900+. Silly bots being so similar!